> github action dependency with the hash of the specific tag and a human readable tag that dependabot will keep/update in the future [1] Allowing bots to do th

> github action dependency with the hash of the specific tag and a human readable tag that dependabot will keep/update in the future [1] Allowing bots to do that is going to make you vulnerable to such attacks anyway. [1] https://github.com/brokenpip3/pre-commit-hooks/blob/f01df657bd43b5043994cf981b216374c15f6ef3/README.md#github-actions-hash https://github.com/brokenpip3/pre-commit-hooks/blob/f01df657...